WordPress Doofinder for WooCommerce Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)
CVE-2023-49185

7.1HIGH

Key Information:

Vendor

WordPress
Status
Doofinder WP & WooCommerce Search
Vendor
CVE Published:
15 December 2023

What is CVE-2023-49185?

A reflected cross-site scripting (XSS) vulnerability has been identified in Doofinder WP & WooCommerce Search. This flaw allows attackers to craft malicious URLs that can execute arbitrary script code in the context of users' browsers. The vulnerability affects several versions of the plugin, making it essential for website administrators to implement protective measures to safeguard user data and maintain the integrity of their sites.

Affected Version(s)

Doofinder WP & WooCommerce Search <= 2.1.7

References

https://patchstack.com/database/vulnerability/doofinder-f...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phd (Patchstack Alliance)
.